Dunning management is the process a business uses to recover failed or overdue payments, running from automated retries on a declined card through escalating customer notices and, if needed, a handoff to outside collectors. For subscription and recurring-billing companies, a disciplined dunning program recovers revenue that would otherwise be lost to expired cards and temporary bank declines. The legal rules that apply to that process shift sharply depending on who is doing the collecting and what tools they use to reach the customer.
Why Payments Fail in the First Place
Most failed charges have nothing to do with a customer refusing to pay. The leading cause is an expired or replaced credit card sitting in the merchant’s vault. Card networks like Visa offer account updater services that push new card numbers and expiration dates to participating merchants, but not every merchant subscribes and not every issuer participates. When the updater misses a card, the next billing attempt bounces.
Insufficient funds during a specific billing cycle account for another large share of declines. A customer may have the money two days later, but if the charge hits at the wrong moment, the bank rejects it. Daily credit limits, holds from recent large purchases, and blocks on recurring international charges create similar one-off failures that resolve on their own if the merchant retries at a better time.
Network timeouts between the payment gateway and the issuing bank can also produce failed authorizations that have nothing to do with the customer’s account. Fraud detection at the bank sometimes flags legitimate recurring charges as suspicious, especially after a customer travels or changes spending patterns. These technical declines are where smart retry logic earns its keep.
How the Dunning Cycle Works
A typical cycle starts the moment a scheduled charge fails. The system automatically retries the payment method on file, usually spacing attempts two to three days apart to catch different bank processing windows. Many platforms use machine-learning models to pick retry times based on historical success rates for similar transactions.
If retries don’t recover the payment within the first week, the workflow shifts to customer-facing notifications. Early messages are low-pressure reminders that a payment didn’t go through, often with a one-click link to update billing information. Mid-cycle messages get more direct, noting the number of days overdue and warning that service access could be affected. A final notice, typically sent 15 to 30 days after the original failure, states plainly that the account will be suspended or canceled if the balance isn’t resolved.
Once the recovery window closes without payment, the account moves to a deactivated state. The business then faces a decision: write off the balance, continue internal collection efforts, or hand the account to a third-party agency. That handoff is where the legal picture changes.
Channels, Tone, and the CAN-SPAM Line
Email is the workhorse of most dunning programs. Automated sequences deliver detail about the failed charge, the amount owed, and a direct link to resolve the issue. Text messages work well as shorter, more urgent nudges for mobile-first customers. In-app notifications or banner alerts catch users the next time they log in.
The tone shifts as the account ages. Early communications read like helpful service alerts. Later messages make clear that continued nonpayment will result in service interruption. The timing of each stage matters for recovery rates and for legal compliance.
Dunning emails that stick purely to billing and account-status information qualify as transactional messages under the CAN-SPAM Act and are exempt from most of the law’s requirements, including the physical-address and opt-out provisions that apply to marketing emails. The exemption holds as long as the email facilitates or confirms a transaction the customer already agreed to, notifies them of a change in account standing, or provides account balance information. Mixing marketing content into a dunning email breaks that exemption. If the message carries a promotional upsell and a reasonable person reading the subject line would read it as promotional, the whole email becomes a commercial message subject to all CAN-SPAM requirements.
When the FDCPA Actually Applies to You
This is the single most misunderstood point in dunning compliance. The Fair Debt Collection Practices Act applies to third-party debt collectors, not to businesses collecting their own debts. If your company bills a customer directly for your own product or service and sends the dunning notices itself, the FDCPA generally does not apply to you.
The statute defines a “debt collector” as someone whose principal business purpose is collecting debts owed to another entity, or who regularly collects debts owed to others. A “creditor” is the person or company to whom the debt is originally owed, and creditors are excluded from FDCPA coverage when collecting their own accounts. One important exception: if a creditor uses a name other than its own in a way that suggests a third party is doing the collecting, it can be treated as a debt collector under the Act.
The FDCPA also only covers consumer debts. The statute defines “debt” as an obligation arising from a transaction primarily for personal, family, or household purposes. Commercial debts between businesses fall entirely outside FDCPA jurisdiction.
None of this means original creditors can say or do whatever they want. Most states have their own unfair and deceptive practices laws, and many of those laws apply to original creditors. Some states also have debt collection statutes that go beyond the FDCPA’s protections. Even when collecting your own consumer accounts, abusive or misleading tactics can still generate state-level liability.
Rules That Kick In for Third-Party Collectors
When a business hands a delinquent account to an outside agency, the FDCPA’s full set of restrictions applies. These rules also matter for businesses that never use outside collectors, because the moment an account is assigned or sold, the buyer or assignee inherits every one of these obligations.
Communication Restrictions
A debt collector cannot contact a consumer at any unusual time or place, or at a time the collector knows is inconvenient. The statute creates a safe harbor: absent other information, collectors should assume contact between 8:00 a.m. and 9:00 p.m. local time is acceptable.1Office of the Law Revision Counsel. 15 USC 1692c – Communication in Connection With Debt Collection If the consumer is represented by an attorney, the collector must direct communications to the attorney. Contact at the consumer’s workplace is off-limits if the collector knows the employer prohibits it.
Consumers can also shut down communications entirely by sending a written notice telling the collector to stop. After receiving that notice, the collector can only reach out to confirm it’s ending collection efforts, or to notify the consumer that a specific legal remedy will be pursued.1Office of the Law Revision Counsel. 15 USC 1692c – Communication in Connection With Debt Collection
The Mini-Miranda Disclosure
Every initial written communication from a debt collector must include what the industry calls a “mini-Miranda” warning: a statement that the collector is attempting to collect a debt and that any information obtained will be used for that purpose. All subsequent communications must also identify that they come from a debt collector.2Office of the Law Revision Counsel. 15 USC 1692e – False or Misleading Representations Omitting this disclosure is itself a violation.
Penalties
A consumer who proves an FDCPA violation can recover actual damages plus statutory damages of up to $1,000 per lawsuit, along with attorney fees and court costs. In class actions, the cap on statutory damages for the class as a whole is the lesser of $500,000 or 1% of the collector’s net worth.3Office of the Law Revision Counsel. 15 USC 1692k – Civil Liability These cases can be brought in any federal district court within one year of the violation.
Regulation F: Validation Notices and Call Limits
The CFPB’s Regulation F, codified at 12 CFR Part 1006, modernized FDCPA enforcement with specific operational rules. Two provisions matter most for dunning workflows handed off to collectors.
What the Validation Notice Must Contain
When a debt collector first contacts a consumer, it must provide a validation notice with specific information about the debt. The notice must identify the debt collector’s name and mailing address for disputes, the consumer’s name and address, and the name of the creditor to whom the debt is currently owed. The collector can use the creditor’s trade name rather than its legal name.4Consumer Financial Protection Bureau. 12 CFR 1006.34 – Notice for Validation of Debts
The notice must also include an itemization of the debt built from a specific reference point called the “itemization date.” The collector picks one of five eligible dates: the last statement date, the charge-off date, the last payment date, the transaction date, or the judgment date. From that baseline, the notice must break out all interest, fees, payments, and credits that have accrued or been applied since.5eCFR. 12 CFR 1006.34 – Notice for Validation of Debts Even if no interest or fees have been added, the fields must appear on the notice. They can show zero, but they cannot be left blank.4Consumer Financial Protection Bureau. 12 CFR 1006.34 – Notice for Validation of Debts
The notice includes a tear-off dispute section at the bottom with checkboxes allowing the consumer to indicate “this is not my debt,” “the amount is wrong,” or describe another reason for disputing.5eCFR. 12 CFR 1006.34 – Notice for Validation of Debts
Call Frequency Caps
Regulation F created a bright-line rule for call frequency. A collector is presumed compliant if it places no more than seven calls within seven consecutive days per debt. After an actual phone conversation, the collector must wait seven full days before calling again about that same debt.6eCFR. 12 CFR 1006.14 – Harassing, Oppressive, or Abusive Conduct Exceeding either limit creates a presumption of harassment. The limits apply per debt, so a collector handling multiple accounts for the same consumer could theoretically make seven calls per week for each separate debt, though doing so might still invite scrutiny.
TCPA Rules for Automated Calls and Texts
The Telephone Consumer Protection Act adds another layer of compliance for any dunning that uses automated dialing systems or prerecorded voice messages. Under the TCPA, calling a cell phone with an autodialer or artificial voice without the consumer’s prior express consent is illegal, with limited exceptions for emergencies.7Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment
The penalties are steep: $500 per unauthorized call or text, tripled to $1,500 if the violation was willful.7Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment Unlike the FDCPA, the TCPA applies broadly. It covers original creditors and third-party collectors alike, and it applies to consumer and commercial calls. A subscription company running automated payment-failure calls to cell phones needs documented consent for every number it dials, regardless of whether it considers itself a “debt collector.”
Credit Reporting and FCRA Obligations
A delinquent account that goes unresolved long enough may end up on the customer’s credit report. Late payments generally won’t appear on a credit report until at least 30 days after the missed due date. Some creditors wait until an account is 60 days past due before reporting. If the customer pays in full before the 30-day mark, many lenders won’t report the late payment at all.
Once a late payment hits a credit report, it stays there for seven years.8Consumer Financial Protection Bureau. How Long Does Information Stay on My Credit Report? That seven-year clock runs regardless of whether the debt is eventually paid.
Any business that furnishes account data to a credit bureau becomes a “data furnisher” under the Fair Credit Reporting Act. Furnishers must report accurate information, and when a consumer disputes a reported delinquency, the furnisher has 30 days to investigate and respond. That window can extend by 15 additional days if the consumer submits new information during the initial period. If the investigation reveals inaccurate reporting, the furnisher must notify the credit bureau and correct the record. A furnisher that reasonably determines a dispute is frivolous must notify the consumer within five business days, explaining why and identifying what additional information would be needed to investigate.
Statute of Limitations and When the Debt Goes Stale
Every debt has a legal expiration date for lawsuits. Once the statute of limitations passes, the debt becomes “time-barred,” meaning the creditor or collector loses the right to sue. Most states set this window between three and six years for typical consumer debts, though some go as short as two years or as long as twenty depending on the type of obligation.9Consumer Financial Protection Bureau. Can Debt Collectors Collect a Debt Thats Several Years Old?
A time-barred debt doesn’t vanish. Collectors can still send letters and make calls, as long as they follow all other applicable laws. What they cannot do is file a lawsuit or threaten to sue. Filing suit on a time-barred debt is itself an FDCPA violation. One catch trips up consumers: if the debtor doesn’t show up to court and raise the statute of limitations as a defense, a judge can still enter a default judgment.9Consumer Financial Protection Bureau. Can Debt Collectors Collect a Debt Thats Several Years Old?
For businesses designing dunning workflows, the statute of limitations determines how long internal collection efforts have legal teeth. Once the window closes, the only leverage left is persuasion, and the balance becomes a candidate for a bad debt write-off.
Writing Off Uncollectible Accounts
When a dunning cycle ends without recovery and the business concludes the debt is worthless, the IRS allows a bad debt deduction, but only if specific conditions are met. The business must have previously included the unpaid amount in gross income, which is the normal situation for accrual-basis companies that recognized the revenue when the sale occurred. Cash-basis businesses that never recorded the income generally cannot deduct the loss.10Internal Revenue Service. Topic No. 453, Bad Debt Deduction
The IRS requires the business to show the debt is genuinely worthless, meaning the facts indicate there’s no reasonable expectation of repayment. You don’t need to wait until the debt’s due date to make that determination, and you don’t need to file a lawsuit first, but you do need to demonstrate that you took reasonable steps to collect.10Internal Revenue Service. Topic No. 453, Bad Debt Deduction A documented dunning workflow showing multiple contact attempts and payment retries over a reasonable period generally satisfies this requirement.
The deduction must be claimed in the tax year the debt becomes worthless. Businesses that let uncollectible accounts linger without formally writing them off risk missing the deduction window entirely. Partial write-offs are also permitted for debts that have become partly worthless, which can apply when a customer pays some but not all of the outstanding balance.10Internal Revenue Service. Topic No. 453, Bad Debt Deduction
Late Fees and Interest on Overdue Balances
Businesses that charge late fees on overdue balances face a patchwork of rules. There is no single federal cap on late fees for most types of consumer debt outside of credit cards. State laws vary widely. Some set specific dollar or percentage limits; others require only that the fee be “reasonable” and disclosed in the original agreement. Prejudgment interest rates on delinquent balances also differ by jurisdiction, typically falling between 2% and 9% annually where state law sets a default rate.
For credit cards specifically, the Credit CARD Act requires that penalty fees be “reasonable and proportional” to the violation. The CFPB attempted to cap credit card late fees at $8, but a federal court in Texas vacated that rule in April 2025, finding it violated the CARD Act’s proportionality standard. As of 2026, credit card issuers continue to set their own late fee amounts within the existing reasonable-and-proportional framework.
Any late fee or interest charge must be clearly disclosed in the original contract or terms of service. Undisclosed fees create exposure under state consumer protection laws and, for debts that end up with a third-party collector, under the FDCPA’s prohibition on collecting amounts not authorized by the original agreement.